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E-MAIL FILTER AND METHOD THEREOF 

FIELD OF THE INVENTION 

The present invention relates to an electronic or 
e-mail filter system as well as a method of filtering unwanted 
e-mail messages. 



BACKG ROUND OF THE INVENTION 

No cogent argument can legitimately be made refuting 
the fact that technology while generally benefitting mankind, 
does have its occasional deficiencies. This is certainly true 
with respect to the communications industry. Unfortunately, each 
technology advancement relating to the ease and facility of 
providing communications between various individuals or companies 
have created minor headaches or problems. Although used 
sporadically since the early 1920 's the utilization of the 
airplane in the mail industry since the end of World War II 
allowed individuals and communities on both the east and vest 
coast to be linked with one another. Mail sent from New York to 
Los Angeles would be received within two or three days from the 
date that the communication was originally posted. Although the 
use of airmail had a salulatory affect upon the communication 
between individuals and other entities, various companies seized 
upon this relatively inexpensive means of communication to. 
inundate the public with a large number of junk mail solicita- 
tions. Unfortunately, to the chagrin of many of these junk mail 
operators, the public could generally dete^ndjie which mail was 
important and which was not, based upon a number of factors such 
as the type of envelopes which were utilized, the return address 
of the sender as well as the manner in which the sendee was 
addressed. Therefore, many of these solicitations were never 
opened and were merely discarded. 

The deregulation of the telecommunications industry as 
well as the increased usage of »800» type numbers has resulted 
in an increased number of unwanted telephone solicitations. 
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While tending to be an annoyance, once the called 
deterges that the y are not interested in an £lc£ ^ 
the type of solicitation, offered by the caller the called 7 
can merely hang up his or her receiver. 

Increased use of facsimile machines in hnhh -v, 
environment as well „ person,! facsimile Klines at" h 
created another avenue for „n„,„ t ed solicitations , 
technology allowed a single aetter „ £ IZT^'on t T 

at is easy to see that facsimile machine solicit-*.- • w 

=„r. bl r parti r rly - hen th - s^snsr - 

receiving . larg e »*, r of correspondences utili z i„„ th, 

rr s ™" p,par - Fu " te — -Moitatio™ ^« ty ^: 

delaved T" " lePh ° ne "° ^ imP °"" t ~ «»» 

— -Lted * ^.^r o£ uMoii=it * d 
».* prov.dT rsn^r ~t h ;rr" - pc " inaust - 

-T Cane U rr a " r % C T Cted ™ " ^ ^ « 

intranet 11. Similar to the situation with rest>ect ^ 
facsimile machines, a solicitor Ci =m ™ respect to 

it . T solicitor can compose a message and send 

it on the Internet and Intranet 11 to a relative i 
of personal computers. Although these e lil m ^ 
necessarily reproduced on paper! the Lnnlr thaT^H ™ T 
-ssages were previously received, the receipt of the 

7£J~ other le9itiraate — f - -i^™^ 

a timely manner. Therefore, it is clear th a t- a „ 111 

US6r fr ° m the «*»«>yance of unsolicited junk e-mail 
U.S. Patent 5,619,648 issued to ', 

erected to a teC^ue for reducing the atunTo ^ e maU 
received hv =» • Wi - juiuc e-mail 

cervea by , user in an e-mail system. As illustrate 
respect to Figure 1 of the Canal e et al M l 

wishes to reduce the amount of Jul e maU w h •' h ^ "*° 

«-< he provided with a mail ^ „t .-^t^ £T£ 
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^system would include a standard e-mail message as well as a 
recipient specifier 121 which uses non-address information to 
further describe the recipients who would receive the e-mail as 
well as a referral list 127 which is a list of potential 
recipients who pass the e-mail on and of recipients to whom the, 
e-mail was provided. The recipients specifier 129 also includes 
a recipient description 125. If the recipient description 
specifies a recipient which is of the same kind as that specified 
by the user model 113, the mail filter 109 adds the mail item 119 
to filtered mail 115. The mail filter 109 can utilize the 
information in the referral list 127 to indicate a chain of 
referrals which resulted in the message being directed to the 
user 105. While this system can be utilized to reduce a users 
junk e-mail, it does not necessarily include a filter technique 
in which mail sent by a sender included in an approved guest list 
filter would be designated as such when received by the user. 
Additionally, this system is not utilized in a manner allowing 
an updated master list of junk e-mail addresses or senders to be 
developed and transmitted to other users in the system. 

U.S. Patents 5,093,918 issued to Heyen et al ; 5,283, 856 
issued to Gross et al; 5,3 77,354 issued to Scannell et al ; 
5,632,011 issued to Landfield et al and 5,634,005 issued to 
Matsuo are all directed to various systems for sorting and 
managing electronic mail or similar messages. However, similar 
to the Canale et al patent, these patents do not describe a 
method or system in which electronic e-mail can be effectively 
filtered by the user as well as compiling an updatable master 
list of unwanted e-mail transmitters which is then transmitted 
to the end user for filter purposes. 

SUMMARY OF THE I NVENTION 

The present invention overcomes the problems of the 
prior art by utilizing a method and system for filtering unwanted 
junk e-mail sent to the user's computer. The user would include 
various addresses or other defining characteristics in a "No 
Admittance List" as well as a plurality of addresses in a "Guest 
List". An incoming e-mail whose addresses are included in the 
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"No Admittance List" would be immediately discarded. Any address 
ln thS " GUSSt List " would ^ immediately forwarded to an -m 
Box" . Any address not included in either the "No Admittance 
List" or the "Guest List" would be forwarded to a "Waiting Room" 
The user would periodically review the e-mail included in the 
"Waiting Room". Based upon this review, the user would either 
discard the e-mail to a "Trash Bin- or would send the e-mail to 
the -in Box" . The addresses of e-mails which were discarded 
after the users review could be automatically added to the "No 
Admittance List". Additionally, the address of any e-mail added 
to the "in Box- after the user's review could also be 
automatically added to the "Guest List". Addresses of e-mail 
which are discarded would be periodically sent to a filter server 
thereby adding the addresses to a master list. This master list 
13 th6n Periodically, transmitted to all of the users in the 
system through a download server. 

The following glossary of terms define various comments 
described in this application. 

A Mail Server is any service that handles the Simple 
Mail Transfer Protocol (SMTP) . Mail Servers are also known as 
Message Transport Systems (MTS) . Examples of Mail Servers are 
Sendmail, Microsoft's Exchange, etc. 

Mail Storage refers to any type of system for storing 
electronic mail (usually stored per user in mailboxes) . Mail 
Storage can consist of file storage, a database, etc. 

A Mail Drop Service is any service that allows users 
to directly retrieve messages from their mailboxes. Users' e- 
mail clients usually directly interact with a Mail Drop Service 
via some protocol. Examples of protocols used by Mail Drop 
Services are the Post Office Protocol (POP) and the Internet 
Message Access Protocol (IMAP) . 

A Mail Reader is any application that can send and 
retrieve e-mail via a Mail Drop Service. Mail Readers are also 
known as User Agents (UA) . Examples of Mail Readers are 
Qualcomm's Eudora, Microsoft Outlook, Netscape Communicator, Elm 
Mn, etc . ' 
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Spam is any unwanted e-mail, also known as unsolicited, 
commercial e-mail (UCE) or junk e-mail. 

BRIEF DESCRIPTION OF THE DRAWINGS 

These and other attributes of the present invention 
will become more apparent in light of the following detailed 
description of an illustrative embodiment thereof, as illustrated 
in the accompanied drawings of which: 

FIGURE 1 is a process flow chart and block diagram 
illustrating the present invention; 

FIGURE 2 is a typical example of a graphic user 
interface according to the present invention; 

FIGURE 3 is a block diagram showing various components 
of the present invention; 

FIGURE 4 is a typical control screen illustrating a new 
search on a member database ; 

FIGURE 5 is a control screen illustrating the search 
results of a member database; 

FIGURE 6 is a control screen illustrating a new search 
on an address database; 

FIGURE 7 is a control screen illustrating the search 
results of an address database; 

FIGURE 8 is a block diagram illustrating the 
collaborative filter of the present invention; 

FIGURE 9 is a block diagram illustrating how the 
collaborative filter is updated; 

FIGURE 10 is a block diagram illustrating server side 
e-mail filtering; and 

FIGURE 11 is a block diagram illustrating the 
collaborative filter replication design. 
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BE SCRIPTXOK OF TH g^PBgpggsg^^^ 

Turning to Figure 1, the entire system of hh<= 
invention 10 broadly includes a section Z a PrSSent 
-er.s personal colter and a ^^^p^™^ ^ 9 

remote from the n^-r-o^^i *»*oviaea at a location 

standard wired o/~ s .re'" ^ ^ . 

the system according to ^ pr ^ e ° n h t ° »»° , re p,« o£ 

wi,h , PProprlMe so 9 , traM he a ~ : a n r:r^ wouid be ™«« 

individualized dual filter. ,-„ erS to P r «P«e 

-~ —u £ r:r\etr™;d iy a ~ cwin 

automatically receive desired e-mail ™ e "J**" "> 
installed directlv bv ,k. software can be 

Popular mai! praams a na ™". " "° Uld "<= ~"«" »"hin 
user. one of ttesTfil^ "".lied *» transparent to the 

users in the ^lo™ "eT ^ T""" * — ' 

determined. This software would^alsc^ al^Ujw ^ ma ^ 1 addresses are 
a customized graphic user <„. . individual to use 

typical graphL use" i„te r£ " e ^ T aPSemble ^ fllt «" * 
hereinafter Howler " t discussed in mo« deC ail 

graphic user interface cat v"^ °* «* the 

and implementation dep «° <ii '" «» "s application 

The software would allow t-v.~ • , . . , 
struct an automatic discard filteT l2 r^T^- '° 
filter is a collective .- . automatic discard 

filter a * C ° lleCtiVe te ™ consisting of a user modified discard 
tiiter, a user personal address filter aiscard 
string filter Duri™ "Iter as well as a user personal 

a r rd « 1 ter\ 2 ri? 1 ™:^er rr-iir ™ ic 

a list of active * ma , n ^ niter list comprising 

section of the userTTmPuter Z " * * — 

incoming e-mail and the current f i, t ^ C °" !Pa " e ' :>n bet »«n any 
within the user's <~ r " llSt °° Uld te «"™Plished 

-Gained at the < ZT a ££\ ^ ~ "« is 

Periodically updated in each of t L u ^ £ " 7" *" ^ 
remote location 4 6 would include ^1 

download server 24 for „„„,.• , 'liter server 22 and 

24 £ ° r 3 P«ticular user as well as delta server 
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filter 2S from all other users. The current filter list can be 
modified by the user to personally remove any addresses therefrom 
through various deletion techniques, thereby providing the user 
with a user modified discard filter. The user personal address 
filter would include additional addresses the user has added to 
the current filter list as well as any character strings that the 
user has added via a text entry containing an «@" . POr the 
purpose of the present invention, a text entry is a character 
string entered into the system by keyboard typing. Typing is 
initiated by double clicking or highlighting and typing, thereby 
clearing an old string and creating a new string. when the mouse 
is clicked on some other location or "enter" is hit, the string 
will be entered into the appropriate memory structure for the new 
field. 

The user personal string filter is defined as any 
character string that the user had added to the automatic discard 
filter to create a "No Admittance List" via text entry that does 
not contain the "@" . The term "No Admittance List" would be a 
list of terms and addresses included to create the automatic 
discard filter. The "No Admittance List" 52 is included in the 
graphic user interface 50 illustrated in Figure 2. 

The Guest List Filter 14 includes addresses the user 
has personally added to the system, for example by dragging an 
e-mail to the "Guest List" 54 shown in the graphic user interface 
of Figure 2, or by any other means. The Guest List Filter 14 
also includes any character strings the user has added via a text 
entry containing an "@" . 

Any e-mail received by the user is checked against the 
automatic discard filter 12 to determine whether any character 
string on the "No Admittance List" 52 will bar entry of any 
e-mail with matching text in its address, subject line or message 
body. If this occurs, that e-mail will be eliminated from the 
users system as indicated by the Trash Bin 16. 

Conversely, any address contained in the Guest List 
which matches an address of an incoming e-mail would be 
automatically forwarded to the In Box folder 18 for review by the 
user. Similar to the situation with respect to the No Admittance 
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52, a text string entered in the Guest List 54 would forward 

folder 16. This feature would allow users to receive on-demand 
direct feting information from parties, promoting producer 
which the user has expressed interest based upon the te*t stjnl 
entered in the Guest List 54. string. 

Incoming e-mail which is not filtered by the atn™- • 
discard filter „ based upon the No .dmittance'Jst 52 oT^ 

^t t ^hT 9USSt " ^ — ^ auest 

to I 7 , aUt ° matiCa1 ^ ««* to a waiting Room folder 2 0 
to be individually reviewed by the user. 

12 h « UnknOWn e_mail St ° PPed by thS autom -tic discard filter 
12 based upon the inclusion of an unwarranted character string 
or based upon a personal review by the user would be used to both 

d"^ UPdate n the addreSS6S ±nClUded in the — - 

discard filter as well as to alert other users in the system of 
the existence of objectionable e-mail addresses. These nil 
*^°*^y and automatically transmitted to I 
address filter server 22 prov ided at the remote central location 
46. Based upon numerical and temporal factors as described 
hereinafter, these addresses are included on the curre^™ 

e : s ::;r with the address mter ™ « ~ m . 

xlter database associated with a database server 24 in 
communication with the address server 22. 

with t-h * eri0diCa11 ^ the database server 24 in communication 
with the address filter server 22 would download updated filter 

iZllir t T e Vari ° US ^ ^ ™ * instructing a^ 

address packet consisting of every address on the current fiLr 

if e ma rr r is a data ^^^ e ^ of N frtrtaHB 

or e-mail addresses and a variable . . 

1=1 var iaDie containing the time r>f 
construction of the packet. The packet is ^^"f 
downloading and uploading multiple e-mail addresses Based up™ 
the particular implementation of the software of the preset 
invention, the updated version of the current filter fist is 
substituted for the Ho Admittance List currently provided in the 
users system. Mternatively. since the „o AdmiltLe Mst might 
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include addresses and character strings personally added by the 
user but not included in the current filter list, the updated 
filter list would be compared with the automatic discard filter 
and any additional entries not included in the automatic discard 
filter would be added thereto. 

Figure 2 illustrates the In Box folder 18 and the 
Waiting Room 20 in more detail as well as giving examples of the 
type of messages included therein. the list of names included 
on the automatic discard filter 12. are provided in the No 
Admittance List 20. Any incoming e-mail whose new address 
matches one of the addresses on this list is immediately 
dxscarded to Trash 16. Addresses may be added to this list via 
an update button 61, the Add to No Admittance button SB, text 
entry, or by dragging a selected e-mail to this window with the 
mouse. The update button 62 automatically downloads the latest 
automatic discard filter from the download server 24. The 
updated filter list is displayed in the No Admittance Window. 
Simultaneously, user added e-mail addresses are sent to the Delta 
Filter server 22 for consideration in future updates to the users 
in the system. 

The Waiting Room folder 20 includes only those e-mails 
that have successfully passed through both the automatic discard 
filter but are not included on the Guest List filter 54. 
Additionally, any e-mail • from any folder may be selected and 
dragged into the Waiting Room 2 0 by the user using his or her 
mouse. The Waiting Room display as shown in Figure 2 would 
include e-mail addresses, the date and time of receipt as well 
as the subject of the e-mail. The exact layout of this Waiting 
Room can be changed depending upon the users requirements. 

An Empty button 56 is associated with the Waiting Room 
20. This button discards all e-mails in the Waiting Room folder. 
If the folder is not empty, a pop up box will be displayed with . 
a warning ensuring that the user wishes the Waiting Room to be 
emptied. if this is the case, a pop up button would allow the 
user to proceed. If the user does not wish to empty the e-mails 
in the Waiting Room, the initial request would be canceled and 
the e-mails included therein would not be cleared. 
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^rsf^^r-"" 

newiy added addree ; e h ° "° Stance »in d ow will scroil to reveal 

The Guest List window 54 would in.i ^ 
on the Guest List filter w in nClUdS 3 list of ^mes 

etches one of the addre^ ^ Wh °" " eW * dd ~ss 

^i- cne addresses on this n of 

forwarded to the In Box folder 18 Jh * " lmmed "tely 

this list via the add to Guest L \ k AddrSS8eS be added to 

dra 3ging a aelected J^to ^ ^ n ^xt entry, or by 

The t„ » Wlnd ° W With a mouse. 

be selected and dragged into J' ^ » ™»" '««■ ™V foider. 
the mouse . Similar to the » ait ™ J y the USer usin 3 

the addrMses , th r d i; : e h ; ,n t te 18 

subject matter of the e-mail Furth P " *" 
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=ha» g . d depending up o„ the user , el t " ^ * * 

-n °Pen slot in the Ho Admittance^^ ',, " °" 
« by doubie clicking on a ^^tLT ^ " 

Chester string to be checked in the m ter ' 
character string on the „o A^ttan J ^ 7T2 ^ 
any e-mail with matching " the ""T ° f 

««« 9e body. Por e^Jze ' I SUb3ecC liM or 

«*. any received e^iTt'ith t'h *" "° 
subject or Mssag! woTad te dtcarLd a B J'"* — "° 
in the Suest Mat woulTfo^ard * f^* '^"^ 
that character string to the m ^ x« 11 »«*9«<> containing 
to type in new e-mail addresses Z' JT * ^ alS ° ^ Used 
°£ the fiater lists. existing ones on either 

a graphic TslrTo £ ^d"'^ "V" '—-^ ™« a llo w 
string of an e-mai, tH^n! tH ' ^ ° r character 

List. elther the Pittance List or the Guest 
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Figure 3 illustrates a typical block diagram of the. 
major components of the preset invention. The present invention 
can be utilized by a home user 17 or by a corporate user 19 
connected to the Internet 11. The provider of the preset 
5 invention is also connected to the Internet and Intranet li 
allowing a web server 13 to advertise the present invention 
through a home page 15. The provider connected to the Internet 
and. Intranet 11 at a second location allows the automatic discard 
filters 11 of the users to be particularly updated. A local area 
10 network (LAN) , wide area network (WAN) or any other type of 
network provided at the remote location 46 allows the address 
filter server 22 to be in communication with the database server 
24 as well as a filter database administration tool 25 allowing 
the provider to maintain complete control over the state of the 
15 address filter and the filter database. Figure 3 also 
illustrates the Internet and Intranet 11 connections between a 
typical home user and a corporate user. 

The address filter server 22 would relay e-mail filter 
user requests to the filter database of the database server 24 
20 and meeting appropriate calls via RPC to a library on the 
database server or by sending SQL commences to the database 
directly. The address filter service will be implemented via 
connection based (TCP) communication. The sending of new 
addresses from an e-mail filter user to the filter database could 
be handled by connectionless (UDP) communication since failure 
to handle all new addresses is not critical. 

Figure 3 illustrates a situation in which the e-mail 
filtering can occur directly at the" home user's PC 17 or a 
corporate user's PC 19 and communication is provided over the 
30 Internet and Intranet 11 to the remote location 46. However this 
invention can be practiced employing a centralized e-mail system 
database 21 connected to the home user's PC 17 or the corporate 
user's PC 19 through the Internet and Intranet 11. m this 
situation the filtering is accomplished at the centralized e-mail 
system database which is the location of the e-mail directed to 
the home user or the corporate user. 



25 
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location. Thee, screens are usee ' " " """^ « nt ™ 1 

editing both the addres " s S ™ T -«chi„ 9 and 

5 that has been sent to the ZT Isl T ° £ ««— 

member database consisting of ,,7- * * " " eU the 
updated their software. p! 9 u« 3 ilT^" ^ ~ t " P ■«« 

database screen » d p igure 9 ""l lu " , "** * * M *>" 
> when information has be" enters"™: ^ d<>Cab " e "°— 

- edd r e S rd?tr.. c r^ c 3 arr for r « ~ 

« — . filter pane! T ^ ^ TlV*' ' ~ * ^ 
information „. tching „ £*« « wouXd contain 

the member- database. Buttons , 2 "h ' * database or 

these databases to appear JTL ™ " Uld all °» «""er of 

database. wuld aJuT^^^"*"-- ™* °' 
database or the dat I~ * a ^ " address 

filter section S3 woul d allowTtri" t T" ™" CUrr ' nt 

various tin^s. It would all, ° ^ UPdated ° r sa ^d « 

number o £ days an adlress « ^"VthT " indiCa " n9 
Without , new instance of that ^dL ^ ■ ^ ""^ Uot 

"Iter users. xt would aXso i™ LTT^ ,V7i t^T * 
number of reporting required for » 9 ^ "° i " ±mm 

current f liter list cert., „, 1? " placed on <*• 

- =et up in m^titut C del' ^ ™ ™ « 
information to be provided de «><«>0">9 "Pon the specific 

Returning to Ficnrre 1 
received e-mails to both the Automatic Disc^Tlt^ 
Guest List fiUter X4 will ™. u ard fl l<=er 12 and the 

30 and 3 2 are compart tTi^f — «■ 
modified discard filter the u ln£0rmatl ° n gained in the user 
users personal string f TtJZZF?" — 
subject line as well .. the !! UtlU "»9 <*• address line, the 
included in e-mails L 30 "7^ ^ ^ 
automatic discard filter. ,11 three of th" "° C ° 0nCaiTOd the 

trotted to the Suest biet fUt\r \ TV*"" "» 

w 14. .The e-mail addresses, 
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subject line and message body of these three e-mails result in 
a match for all three of these e-mails. Consequently, these 
e-mails are sent to the In Box folder 18. 

E-mails 34 and 36 were sent from a known bulk e-mailer. 
Since information in these e-mails are included in the automatic 
discard filter 12, both of these e-mails are directly sent to 
trash 16. 

Four unknown e-mails 38, 40, 42, and 44 are initially 
sent to the automatic discard filter 12 . E-mail filter 38 is 
automatically stopped by the automatic discard filter and sent 
to trash 16. Although the address of this e-mail is not 
initially included in the automatic discard filter 12 the subject 
line or message body contains a character string included in the 
automatic discard filter. The address of this e-mail is 
15 automatically added to the discard filter 12. During the next 
master filter update, this new junk e-mail address will be 
forwarded to the Delta Filter Server 22. E-mail 40 passes 
through the automatic discard filter 12 and is stopped by the 
Guest List filter 14 and is then forwarded to the Waiting Room 
20 folder 20. Upon review, the user decides to place this address 
on the automatic discard filter. Future e-mails from the same 
sender will be sent to trash. During the next master filter 
update, this new e-mail would be forwarded to the Delta Filter 
Server 22. E-mail 42 passes through the automatic discard filter 
25 12 and is stopped by the Guest List filter 14 and is then 
forwarded to the Waiting Room folder 20. The user reviews this 
e-mail and decides to place it on the Guest List. Future e-mails 
from the same sender will be sent to the In Box folder 18. 

E-mail 44 passes through the automatic discard filter 
3 0 and is stopped by the Guest List filter 14 and sent to Waiting 
Room 20. Since the user took no action with respect to this 
e-mail, it would remain in the Waiting Room folder. 

Collaborative Filtering Technology (CFT) is a filtering 
solution for stopping junk e-mail and involving end users in the 
3 5 war against spam. CFT works by leveraging the actual spamming 
experiences of end users to create a dynamically changing set of 
junk e-mail filter rules. These rule sets are then used to sort 
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spam. The technology is simple, effective and empowers end users 
by involving then, as active players in the spam wars 

Collaborative Filtering Technology is the best e-mail 
fxlterxng solution for organizations with numerous e-mail users 
such as internet service providers (ISPs, , free Internet e-mail 
probers, and MIS departments of major corporations. Thls 

nfr^tZt lnte9 r eS W611 aCr ° SS Var±OUS Platf °- — 
of end arChlt6CtUreS ' - .extremely high level 

of end user protection with relatively li ttle administrative 
burden Collaborative filtering maximizes benefits whill 

minimizing costs. 

she de -H When " ^ USer reCeiV6S 3 P±eCe ° f e " mail ^ he or 
she decides is 3 unk mail, the user submits that message to the 

Collaborative Filter through a simple button click. The e-mail- s 
body is analyzed and it is stored in the Collaborative Filter 
mess 1 9 T StatiStica1 ^ significant number of the same 

message have been submitted, the Collaborative Filter is updated 
to .tart filtering all such messages from the system. Li ke 
othe r e-mail filtering systems, the Collaborative Filter does not 

TTZZ Z T liZG S ° UrCe f±lterin - — Bering — an 
email s header information to filter e-mail from given source 

addresses Experience indicates that source filtering is 
inappropriate for completely filtering junk e-mail since e-mail 
headers are easily forged. Instead, the Collaborative Filter of 
the present invention uses message filtering based on an e-mail's 
body Because the e-mail-* body must contain a message (i.e. 
thl H t " emSnt) thiS messa * e cannot be drastically altered, 

fiTt^" theref ° re thS m ° St a PP^iate data to be used for 

side «^ ^ COllab ° rative Filte - " an indentation of server 

at th M e T 9 ' SSrVer SidS filterin * is «lt«i„g that occurs 
at the Mail Server or Mail Drop service level. Th is is a 
different approach from client side filtering, in which filtering 
occurs at the Mail Reader level. Server side filtering J 

SeL r e ° Priat ; ^ ° r9aniZation ^ -nages its own Mail 

Servers and Mail Drop Services because it saves network, storage 
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resources, and end user time by stopping spam from propagating, 
throughout the network. 

The Collaborative Filter is comprised of two major 
components: the Spam Filter and the Submittal Filter. The Spam 
Filter is responsible for filtering incoming e-mail while the 
Submittal Filter filters user submissions to the Spam Filter. 
These two components cooperate to form the Collaborative 
filtering process that consists of the following major steps as 
shown in Figure 8 . 

All incoming messages are first filtered at the Mail 
Server using the Spam Filter. If the incoming message is found 
on the Spam Filter, it is discarded. All other messages pass 
through to the Mail Drop Service. 

E-mail is then distributed to the end user mailboxes. 
15 When users download their e-mail from the Mail Drop Service, it 
is filtered again via the Spam Filter. Those that match are 
disc a rde d before the users ever see them. All other messages 
pass safely through to the user. it is necessary to filter at 
both the Mail Server and Mail Drop Service level to ensure that 
20 end users are protected by the latest updates to the 
Collaborative Filter. However, the system would still operate 
if no filtering were to be done at the Mail Drop Service level . 

When end users receive a spam message, they need only 
to press a button to submit it to the Collaborative Filter. This 
25 simple action forwards the junk e-mail to a mailbox (e.g. 
gpam®jsp r net) where it is examined by the Submittal Filter and, 
if appropriate, is used to update the Spam Filter. If the 
message does not already exist in the Spam Filter, then it is 
added. If it is already present, then the time of submission is 
30 recorded, and the total number of submissions of that spam is 
increased by one. The filter uses this counter to determine 
whether to filter against this message. Only messages received 
within a certain time frame with a counter greater than or equal 
to a predetermined threshold will be used in filtering. This 
35 threshold ensures that a small but statistically significant 
number of users have submitted to the same spam message before 
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it is filtered. This prevents inappropriate filtering „ 
user error, of i mp roper submissions ^ dUS t0 " 

System administrators use the PHhov tv^i • • 
Tool to define a list of . • , * Filter Administration 

erine a last of e-mail addresses or domains th*t- ^ 
be submitted to the Spam Filter This li^ , ^ 

database of the Submittal Filter ZZ " ^ ^ 

submitting messages from lol va ii d ^ MM » f ™ 

administration broadcast ^Z^L^Z^ " ~ 

CollaboraJtrFU^ir'^Tr:: 311 ""^ * ^ ° f 

users (use. a \ Slmple e * am P^< there are two 

users (user A and user B) ar ,H 

-rs. The spam message has "ver b ^ """^ ^ ^ b0th 

Collaborative Filter. " Pr ° Ces8ed by the 

Initially, the spam message enters 
* logs on first and checks e . m fil J a a 7 USSr 

messages: his non-spam message and a spam J ^ 
«~ a a s P am mess acre . Not** t-H=>+- 

■pan. message passes through the £ilt.^ „• the 
seen before User A 7u ° " hM n,v « b «» 

CollaWative P11 ter "a ^ """^ ^ " *» — 

CoHaborative F ilt er uses User "T ^T"" ""**• 
filter. From this ™- . submission to update the 

—s th e ^ — ^^--r^ ~ 

operation.^erarni 8 t * ^"T^ ™' « 

-Uer he gins n^^JT^? T ^T™" 

number of end users -will ^ * UDnuttal - In actuality, the 

Filter will only star tlxlte ^ ^ ^ C ° llab ~ a <=ive 

submitted by a signif icant ! ' ^ * ^ " ^ 

y a significant number of thoqp i, ac ^„ 

of users will be Spam free li ke User B while I smail 

of users experience spam and protecf the larger "f" 

community (l ike Uaer A) * Cne lar 9er end user 

The Collaborative FiHor „„ . _ 
components nan^w ^ o consists of two major 

P nents, namely the Spam Filter and the Submittal Filter. 
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The Spam Filter filters incoming e-mail, and the. 
Submittal Filter filters end user junk e-mail submissions to the 
Spam Filter. End user submissions update the Spam Filter while 
system administrators decide what entries reside on the Submittal 
Filter. System administrators can add, remove, and update 
entries on both the Spam Filter and Submittal filter via a Filter 
Administration Tool. 

The Collaborative Filter is a server side filtering 
solution as shown in Figure 10. Service side filtering occurs 
at the mail Server or Mail Drop Service level . This is a 
different approach from client side filtering, which occurs at 
the Mail Reader level. Server side filtering is appropriate for 
any organization that manages its own Mail Servers and Mail Drop 
Services because it saves network and storage resources by 
stopping spam from propagating throughout the corporate network. 
Another advantage is that end users are not forced to waste time 
downloading, reading, and deleting junk e-mail. Note that client 
side filtering is an appropriate filtering technology when end 
users are not protected from junk e-mail by server side filtering 
products. Figure 10 also illustrates a typical server side 
filtering scenario. 

It is noted that filtering at the Mail Drop Service 
ensures that the most recent updates to the Spam Filter are used 
to eliminate junk e-mail that has already been sent to a user's 
mailbox, but has not yet been downloaded. This allows the 
Collaborative Filter to eliminate spam to most users on its first 
mailing. 

The Collaborative Filter is implemented via a set of 
C libraries. The Collaborative Filter has been implemented in 
C due to the following^ requirements : 

1. The Collaborative Filter must be efficient. 

2. The Collaborative Filter libraries must be cross- 
platform. 

3. The libraries must allow for easy integration 
with customer software. 

A C implementation achieves these goals because: 
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C 



is a highly efficient development language 
because it is compiled. its long history has 
allowed for the development of highly optimized 
compilers . 

2- The C language is highly portable, since most 
hardware vendors provide C compilers for their 
products. in addition, the ANSI c standard 
defines a standard library, which can be reliably 
used to write portable code. 
3. c is an industry-wide development language, used 
by millions of developers around the world 
Therefore, it is extremely i ±fcely that any 
customer can integrate the Collaborative Filter 
libraries into his/her software. i„ addition 
most popular development languages allow for 
calling c directly (e.g., c++ , Java, Perl, Visual 
Basics, etc) . 

The spam Filter Library contains the code needed to 
filter e-maxl. This library contains the s PamCheck() routine 
whxch xs used to check if a given e-mail is junk. The call" 
passes a structure to 8pamCheck( ) which contains pointers tQ ^ 
headers and body of the message to be checked. Therefore if a 
message's headers and body are already in memory (e.g., when a 
Maxl server xs processing a SMTP connection), then no memory 
copyxng will be needed and s PamCheck() can efficiently cheZ 
whether a message is junk. 

The spamCheckO function checks whether a given e-mail 
is uunk in the following fashion: 

1- span,Chec*f; generates a signature for the- 
tne ssage . 

2. spamCheckO queries the Spam Database for the 
message's signature. 

3. if the database query does not find the message's 
signature, then the e-mail is not junk and it an 
be passed on to end users. 

4. If the database query does find the message's • 
sxgnature, then a matching function is used to 
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determine whether or not the message in questions, 
truly matches a message in the Spam Filter 
database. 

a. If the matching function does not find 
these messages to be equivalent, then 
the message is not junk, 

b. If the matching function does find 
these messages to be equivalent, then 
the message is filtered. 

Source filtering is based on a message's sender 
information. Most source based filtering techniques use the 
"From" address from the message's header. Source based filtering 
is not appropriate for completely filtering junk e-mail since 
headers are easily forged. To overcome this limitation, the 
Collaborative Filter primarily uses the message body for 
filtering. This is known as message based filtering. 

The signature described in the above process is a hash 
function based on the message* s body. Message signatures are 
very important because they allow the Collaborative Filter to 
operate in an efficient manner. The message signature enables 
non-junk e-mail messages to quickly pass through the filter. 
This occurs because it is extremely unlikely that an incoming 
non-junk message signature will match the signature of a junk e- 
mail already stored in the database. 

Since the message signature is a type of hashing 
function, there will be some unavoidable signature collisions 
(i.e., two unique messages which generate the same signature). 
The filtering algorithm resolves signature collisions by 
calculating a matching function on both messages to ascertain if 
these messages are really equal. The matching function- uses a 
combination of techniques (e.g., checksum, fuzzy matching) to 
generate a likelihood that two messages are essentially 
equivalent. Exact comparisons cannot be used since junk e-mail 
senders will embed extra characters in their outgoing e-mails to 
circumvent message based filtering techniques. For example, 
spammers may add extra characters at the beginning of a message 
by including personalized salutations. A fuzzy matching function 
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is the appropriate solution to this problem because a spammer 
cannot change that portion of an e-mail < e body that contains his 
or her message (e.g., advertisement). 

The Submittal Library contains the code needed to 
handle user submissions to the Collaborative Filter. The library 
contains the spamSubmi t () routine which is used to submit a 
user's junk e-mail message to the Collaborative Filter. 

End users will have a mechanism for forwarding a piece 
of junk e-mail to the Collaborative Filter. This mechanism will 
forward the junk e-mail message to a defined mailbox for handling 
junk e-mail (e.g. spam@isp.net). The Submittal Library is then 
used to process these incoming junk e-mail submissions. 

The main job for the Submittal Library is to filter 
incoming submittals to ensure that valid messages are not 
included in the spam filter. Examples of such messages are 
system administration broadcast messages and mailing lists. 

The spamSubmit() routine submits spam to the Spam 
Filter in the following fashion: 

1. The forwarded junk e-mail is parsed from the 
submission e-mail sent by an end user. 

2. The Submittal Filter is checked to determine 
whether this submitted junk e-mail should be 
added to the Spam Filter. 

3. When a submitted junk e-mail is added to the Spam 
Filter, the Spam Filter is updated by 
spamSubmi t () . 

Note that the Submittal Filter is not updated via the 
spamSubmitO routine. The Submittal Filter is updated by the 
Filter Administration tool that uses direct SQL commands to 
add/ remove/update entries on the Submittal Filter. 

The Spam and Submittal Filters are both stored in 
relational databases. Relational database technology was chosen 
due to its mature nature and ability to handle numerous 
transactions. These are extremely important considerations since 
the Collaborative Filter will filter all incoming e-mail. " 

The Collaborative Filter only interacts with relational 
databases via SQL commands. This allows the Collaborative Filter 
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to be integrated with any SQL compliant database. Leveraging, 
existing database technology allows the execution of a filtering 
product that is more cost effective, efficient and reliable. In 
addition, since the filter back-end is implemented via a 
5 database, customers and other third parties can access the. 
filter's data for their own specialized needs. 

By using off the shelf relational database products, 
the Collaborative Filter can utilize those products' replication 
technology to scale the Collaborative Filter across the 
10 enterprise as shown in Figure 11. The Collaborative Filter's 
replication design is based on one master database and. numerous 
read-only replicated sites. This simple replication strategy 
contains no update conflicts and is available from various 
database vendors (e.g., Sybase's Replication Server, Oracle 
15 Snapshots) . 

Under this scheme, network bandwidth allocation is 
flexible, since the schedule for database replication can be 
modified to meet other operational needs. Administrators have 
control over how much network bandwidth they are willing to spend 
20 for more effective junk e-mail filtering (i.e., the more 
synchronized the databases, the more effective the filter) . 

The Filter Administration tool allows system 
administrators to administrate the Spam Filter and Submittal 
Filter. This tool is the main mechanism for adding, removing and 
25 updating entries on the Submittal Filter. 

The Filter Administration Tool consists of a web based 
front end making Hyper Text Transfer Protocol (HTTP) requests to 
a Java Servlet interacting with the Spam Filter and Submittal 
Filter databases with Java Database Connectivity (JDBC) . This 
30 design— has— the following advantages. 

1. Administration can use any web browser to 

administrate the Collaborative Filter. 
2 . This Java solution allows the Filter 
Administration Tool to be both platform and 
35 browser independent. 
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3. The performance requirements of the application 
are well within the performance parameters of 
Java . 

The Collaborative Filter is designed to be tightly 
xntegrated with a customer- a existing Mail Servers, Mail Drop 
Services, and relational databases. Due to the range of customer 
requirements, one should anticipate that some amount of custom 
coding would likely be required to integrate the Collaborative 
Filter into a customer's operations. 

A Mail Server and Mail Drop Service Integration is the 
most involved step in integrating the Collaborative Filter since 
source code modifications must be made to a customer's Mail 
Server and Mail Drop Service. The Mail Server and Mail Drop 
Service must be modified to call the spamCheck () routine at 
appropriate places. 

However, even if customers do not have access to their 
Mail server or Mail Drop Service source code, the Collaborative 
Palter can still be integrated in a proxy application. For 
example, a proxy SMTP application can be built which sits on top 
of the Mail Server and makes calls to the Spam Filter library 
E-mail that passes the filter in the proxy application is then 
forwarded to the Mail Server by the proxy. Note that the same 
can be done for POP3 and IMAP4 Mail Drop Services. 

A relational database system must be allocated to hold 
the Collaborative Filter. The system must be able to handle the 
extra bandwidth generated by queries form the Spam Filter 
library. For large organizations, it is recommended to use a 
dedicated database system for the Collaborative Filter 
Customers should note that the Collaborative Filter has an 
unusual query load compared to most on-line transaction 
processing systems, since over 90% of its requests will be pure 
queries (i.e., there will be very few inserts, updates or 
deletes) . Due to this unique query load, a dedicated database 
system that can be optimized for filtering is recommended... 

Once a database system has been allocated, installation 
consists of running several SQL scripts to install the 
Collaborative Filter. When the database has been installed the 
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customer will have to perform standard database administration 
tasks (e.g., backup). 

Once the Spam Filter and Submittal Filter databases 
have been set up, the Filter Administration Tool's Java Servlet 
must be installed on a Web server that has access to these 
databases. System administrators will then connect to this Web 
server to administrate the Collaborative Filter via their Web 
browser. 

The present invention has been explained with respect 
to specific arrangements and methods. However, it is noted that 
these arrangements and methods are merely illustrative of the 
principles of the present invention. Numerous modifications in 
form and detail may be made by those of ordinary skill in the art 
without departing from the scope of the present invention. 
Although this invention has been shown in relation to a 
particular preferred embodiment, it should not be considered to 
be so limited. 
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WHAT IS CLAIMED IS: 



1. A system for filtering electronic mail received over 
a communication medium to a user. a computer comprising.- 

a first filter provided in the. user's computer 
proved with first a list of addresses from which the user doL 
not wish to receive electronic mail; 

a second filter provided in the user's computer 
Provided with a second list of addresses from which the user does 
wish to receive electronic mail; 

COmpariSOn device Provided in the user's computer 
f<-r comparang tb* addresses included in said first filter and 
sa ld second filter with the address of electronic mail reeled 
by Eai d user's computer, wherein any electronic mail whose 
address xs discovered by said comparison device to be included 
» sa.d first list of addresses will be automatically dented 

whlse ,H Ser ' S COmPUter ' "* WWein ^ Electronic mail 

InT, !f 18 d±SCOVered * Said comparison device to be 

included xn said second list of addresses would be retained in 
the user's computer for review by the user. 

2. The system in accordance with claim l, further 
include a first- folder for retaining electronic mail rece^d 
xn the computer whose address is not included in said first list 
of addresses but is included in said second list of addresses. 

3. The system in accordance with claim 2, further 
xnclud lng a second folder for retaining electronic ^ ^ 

JLst 1 T P T r Wh ° Se addreES ±e lnClUded in Either said 

IZl k ! ad£h? — or s^id second list of addresses for " 

^ate W d y - / Ser " a time ' ^ an 

update devxce for adding addresses to said first filter or Lid 

second filter based upon the user's review, thereby creating a 
first updated list of first addresses and a first updatelMst 
of second addresses. P ^ 1St 
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4. The system in accordance with claim 1, further 
including a device for periodically sending said first updated 
list ^ of first addresses to a master database situated at a 
location remote from the user's computer. 

5 . The system in accordance with claim 4 , further 
including a device for periodically receiving a list of addresses 
from the master database to be added to said first filter to 
create a second updated list of first addresses. 

6. A system for filtering electronic mail received over 
a communication line to a user's computer comprising; 

a first filter provided in the user's computer 
provided with a first list of addresses from which the user does 
not wish to receive electronic mail as well as a first list of 
objectionable character strings; y 

a second filter provided in the user's computer 
provided with a second list of addresses from which the user does 
wish to receive electronic mail as well as a second list of 
acceptable character strings; 

comparison device provided in the user's computer 
for comparing the addresses and character strings included in 
said first filter and said second filter with the address of 
electronic mail as well as character strings provided in the 
electronic mail received by said user's computer, wherein any 
electronic mail whose address is discovered by said comparison 
device to be included in said first list of addresses or 
electronic mail containing a character string included in the 
first list of objectionable characters string, will be 
automatically deleted form the user's computer, and further 
wherein any electronic mail whose address is discovered by said 
comparison device to be included on said second list of addresses 
or said second list of acceptable character string, would be 
retained in the user's computer for review by the user. 

7. The system in accordance with claim 6, further 
including a first folder for retaining electronic mail received 
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of ItV 0 ^* Wh ° Se addrSSe 15 ^ ±nCluded - "id first list 
of addresses, said first list of objectionable character string 
« said second l ist of addresses or said second lis ^ 
acceptable character strings. ° f 

8. The system in accordance with claim 7 f„ 
i»cludi„ 3 . second folder foI r8t , inlng electr<j -- J- - «~ 

» whose .^ress is not lncluded in ^ 

of addresses, said £irst llst of objecUonable cbsr £" 

7 Md list » £ or said second list of Lep t r; 

character string, £o r review by the user at a later 121 ! 

f*rst filter or said second filter based upon the user's revi" 
creating first updated first n .t- „e review, 
-end list of addresses addresses and an updated 

lnn1 9 * SyStem in a^ordance with claim a, further 

ixst T 9 ,: deViCS «^"y sending said firs t uplted 

list of addresses to a master database situated at a l 0 L 
remote from the user's computer. locatxon 

lnrll ,. "J The SyStem in accordance with claim 9, further 
f rim th 9 3 6 Peri0dica1 ^ — iving a list of addresses 

from the master database to be added to said first filter to 
create a second updated list of first addresses. 

11. A system for filtering electronic mail transmitted 
on a communication medium comprising.- ansnutted 

one or more user computers connected to hh B 
creations Una. each of said computers includ^ .first 
filter provided in each of said colters provided with , first 
list of addresses from which a user does not wish to receive 
electronic mail, a second filter provided in reCeive 
provided „ ith , second list of addressee fr" 2^1 ZT^Zl 
21 of ele ° t ~' ,iC * =-P.ri-n device provided^ 

filter and said second filter with the address of 
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electronic mail received by said computer, a first folder for 
retaining electronic mail received in said conputer whose address 
is not included in said first list of addresses but is included 
in said second list of addresses, a second folder for retaining 
5 electronic mail received in said conputer whose address is not 
included in neither said first list of addresses or said second 
list of addresses for review by the user at a later time, and 
further including an updated device for adding addresses to said 
first filter based upon the user's review, thereby creating a 
10 first updated first list of addresses; and 

master server and master database connected to 
said one or more computers by the communication medium for 
periodically receiving said first updated first list of addresses 
to be inserted into said master database and for periodically 
transmitting to each of said computers a list of addresses to be 
added to said first filter to create second updated list of first 
addresses . 



15 



20 



25 



12. A method for filtering electronic mail received 
over a communications medium at a user's computer comprising: 

creating first list of addresses from which the 
user does not wish to receive electronic mail; 

inputting said first list of addresses into the 
user's computer as a first filter- 
creating a second list of addresses from which the 
user does wish to receive electronic mail 

inputting said second list of addresses into the 
user's computer as a second filter; 

comparing the addresses included in said first and 
3 0 sereond list ox addresses with the address "of a received 
electronic mail; 

automatically deleting the electronic mail form 
the user's computer if the address of the electronic mail is 
included in said first list of addresses; and 
35 retaining the electronic mail in a first location 

in the computer if the address of the electronic mail is in said 
second list of addresses or retaining the electronic mail in a 
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second location in the computer if the address 

~xl x. not included in either said first "st ^ * l£Ctr ° nic 
said second list of addresses. addresses or 

5 13. The method in accordance wi»-h „i • 

comprising the steps of : Claim 12 ' further 

second location^" 1119 ^ included in said 

" upon said reva J^^ 9 ^ -11 based 

electronic ^ilT^? Att^f ^ °< ™ 
list of f irst addresses; J* fllter to Creat - - «rst updated 

» o f first ad d re S ™Tr™ir said first — d — 

-e^ion to create an ^Z^^^ " ' ~*« 

including He ^^JL^TT ^ ^ 
20 master database to said one 0 ' transmitt ^ said updated 

second updated list of f.rst adZ ^ to Reduce a 

first filter. addresses to be included into said 

, c 15. The method in accordance w-it-h „i • 

25 said f iret filter includea lia . a ^ e " lth Claim wherein 

brings compared to character strl ° b3eCti ° nable ^aracter 
electronic mail. ""^ lnclu <*e<* in a received 

16. A system for f lit- «~ -i 
" «« . co^unication mdi „ ^J^T r ~ 1 « d 

» fir* mt« pr r ided "T" ""^^ 

provided with first a list „, „• " 6er ' s <=°mputer 

which the user doe * ZT^rT^ 
« least one of said objection!!. ^ Tronic „ U 1£ 

« in the electronic mail, strings is incited 

a second filter provided in t-K 
P-vided with a second list of acceptatTe l^ZZllZTtZ 
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which the user does wish to receive electronic mail if at least 
one of said acceptable character strings is included in the 
electronic mail; 

comparison device provided in the user's computer 
for comparing the character strings included in said first filter 
and said second filter with the subject line and body of 
electronic mail received by said user's computer, wherein any 
electronic mail which includes a character string discovered by 
said comparison device to be included in said first list of 
objectionable character strings will be automatically deleted 
from the user's computer, and further wherein any electronic mail 
which includes a character string discovered by said comparison 
device to be included in said second list of character strings 
would be retained in the user's computer for review by the user. 

17. The system in accordance with claim 16, further 
including a first folder for retaining electronic mail received 
in the computer whose subject line and body does not include a 
character string proceed in said first list of character strings 
but is included in said second list of character strings. 

18. The system in accordance with claim 17, further 
including a second folder for retaining electronic mail received 
in the computer not included in character strings provided in 
either said first or second lists for review by the user at a 
later time, and further including a update device for adding 
character strings to said first filter or said update device for 
adding character strings to said first filter or said second 
filter based upon the user's review, thereby creating a first 
updated first list of objectionable character strings and an 
updated second list of acceptable character strings. 

19. The system in accordance with claim 16, further 
including a device for periodically sending said first updated 
first list of objectionable character strings to a master 
database situated at a location remote from the user's computer. 
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20. The system in accordance with claim 19, further 
including a device for periodically receiving a list of objec- 
tionable character strings. 

21. A system for filtering electronic mail recorded 
over a communication medium by a user's computer comprising: 

a first filter located at a central location 
provided with first a list of addresses from which the user docs 
not wish to receive electronic mail; 

a second filter located at the central location 
provided with a second list of addresses from which the user does 
wish to receive electronic mail; 

conrparison device located at the central location 
for comparing the addresses included in said first filter and 
said second filter with the address of electronic mail received 
at the central location and directed to the user, wherein any 
electronic mail whose address is discovered by said comparison 
device to be included in said first list of addresses will be 
automatically deleted from central location, and further wherein 
any electronic mail whose address is discovered by said compari- 
son device to be included in said second list of addresses would 
be retained at the central location for review by the user. 

22. The system in accordance with claim 21, further 
including a first folder for retaining electronic mail received 
at the central location whose address is not included in said 
first list of addresses but is included in said second list of 
addresses. 

23. The system in accor dance -with claim 22, further 
including a second folder for retaining electronic mail received 
at the central location whose address is not included in either 
said first list of addresses or said second list of addresses for 
review by the user at a later time, and further including an 
update device for adding addresses to said first filter or said 
second filter based upon the user's review, thereby creating a 
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first updated list of first addresses and a first updated list, 
of second addresses. 

24. The system in accordance with claim 21, further 
including a device for periodically sending said first updated 
list of first addresses to a master database situated at a 
location remote from the user's computer and the central 
location. 

25. The system in accordance with claim 24, further 
including a device for periodically receiving a list of addresses 
from the master database to be added to said first filter to 
create a second updated list of first addrenses. 

26. A system for filtering electronic mail received 
over a. communication medium by a user's computer comprising: 

a first filter located at a central location 
provided with a first list of addresses from which the user does 
not wish to receive electronic mail as well as a first list of 
objectionable character strings ; 

a second filter located at the central location 
provided with a second list of addresses from which the user does 
wish to receive electronic mail as well as a second list of 
acceptable character strings; 

comparison device located at the central location 
for comparing the addresses and character strings included in 
said first filter and said second filter with the address of 
electronic mail as well as character strings provided in the 
electronic mail received ' at the central location, wherein any 
electronic mail whose address is discovered by said comparison 
device to be included in said first list of addresses or 
electronic mail containing a character string included in the 
first list of objectionable character string, will be 
automatically deleted from the central location, and further 
wherein any electronic mail whose address is discovered by said 
comparison device to be included on said second list of addresses 



WO 99/32985 



PCT/US98/26233 



32 



or said 1 second list of acceptable character strings, would be 
retained at the central location for review by the user. 



27 



The system in accordance with claim 26, further 

™t \ fi r: folder for reta±ning eiectronic ^ ~™ 

first Ast , r tl0n WhOSS addrSSS ±S inClUded in 

farst ixst of addresses, said first list of objectionable 

character strings, said second list of addresses or said secon! 

last of acceptable character strings. 

28. The system in accordance with claim 27, further 
including a second folder for retaining electronic mail received 
at the central location whose address is not included in said 
fxrst l ls t of addresses, said first list of objectionable 
character strings, said second list of addresses or said second 
-Ust of acceptable character strings, for review by the user at 
a later time, and further including an update device for adding 
addresses to said first filter or said second filter based upo 
the user . s review , thereby creat . ng a f . rst updafced 

addresses and- a first updated list of second addresses. 

29. The system in accordance with claim 28, further 

TlT^m deVlCe PeriGdica11 ^ 8end *ng -id first updated 

Ixst of addresses to a master database situated at a location 
remote from the user's computer. 

30. The system in accordance with claim 29, further 

f rom ,r 3 deV±Ce Peri0diCa11 ^ reiving * list of addresses 
from the master database to be added to said first filter to 
create a second updated list of first addresses. 

31. a method for filtering electronic mail received 
over a communications medium be reviewed by a user's computer 
comprising: H 

creating a first list of addresses to a central 

TtTstt^T d ^ COmmUniCati ° nS medium th -eby creating 
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creating a second list of addresses from which the 
user does wish to receive electronic mail; 

introducing said second list of addresses to the 
central location connected to the communication medium, thereby 
creating a second filter; 

comparing the addresses included in said first and 
second list of addresses with the address of an electronic mail 
received in the central location; 

automatically deleting the electronic mail from 
the central location if the address of the electronic mail is 
included in said first list of addresses; and 

retaining the electronic mail in a first location 
in the central location if the address of the electronic mail is 
in said second list of addresses or retaining the electronic mail 
in a second location in the central location if the address of 
the electronic mail is not included in either said first list of 
addresses or said second list of addresses . 

32. The method in accordance with claim 13, further 
comprising the steps of: 

reviewing any electronic mail included in said 
second location; 

eliminating any unwanted electronic mail based 
upon said reviewing step; 

recording the electronic address of any unwanted 
electronic mail in said first filter to create a first updated 
list of first addresses; and 

periodically transmitting said first updated list 
of first addresses to a master database situated at a remote 
location to create --updated master database. 

33. The method in accordance with claim 32, further 
including the step of periodically transmitting said updated 
master database to the central location to produce a second 
updated list of first addresses to be included into said first 
filter. 
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34. The method in accordance with claim 32, wherein 
said first filter includes a list of objectionable character 
strmgs compared to character strings included in a received 
electronic mail. 

35. A method for mail server side filtering electronic' 
man received over a communication medium comprising the steps 
of : ^ 

providing a first filter at the mail server 
including a list of spam messages which should not be sent to an 
end user; 

reCeiving a first electronic message ultimately 
intended for one or more end users at the mail server; 

COmparin 9 at the s *id mail server said received 
first electronic message to said spam messages provided in said 
first filter, said received first electronic message discarded 
if said received first electronic message is included as a spam 
message in said first filter and transmitting said first 
electronic message to the end user if said received first 
electronic message is not included as a spam message in said 
first filter; 

providing a second filter at the mail server for 
the receipt of a second electronic message sent over the 
communications medium from an end user, said second electronic 
message received at said second filter considered to be a spam 
message by the end user; and 

adding said second electronic message to said 
first filter as a spam message, if said second filter determines 
that said second electronic message is a spam message. 

36. The method in accordance with claim 35, further 
including the steps of: 

providin 9 a counter associated with said second 

filter; 

counting the number of repeated second electronic 
messages received by said second filter.; and 
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adding said second electronic message to said, 
first filter as a spam message if said counter exceeds a 
predetermined value * 

5 37. A system for filtering electronic mail received 

over a communication medium to an end user's computer, compris- 
ing: 

a mail server for receiving first electronic 
messages intended to be received by the end user, said mail 

10 server provided at a location remote from the end user; 

a first filter located at said mail server, said 
filter including a list of spam messages which should not be sent 
to the end user, said first filter also including a device for 
comparing at least a portion of the body of said first electronic 

15 messages with each of said spam messages; 

a second filter located at said mail server for 
receiving second electronic messages transmitted over the 
communication medium to said mail server from the end users; 

a counter and comparison device located at said 

20 mail server and in communication with said second filter for 
counting and classifying the number of said second electronic 
messages received by said second filter, said counting and 
comparison device determining the number of similar second 
electronic messages received by said second filter; 

25 wherein when the number of similar second 

electronic messages received by said second filter exceeds a 
predetermined number, said similar second electronic message is 
added to said first filter as an additional spam message. 
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